{
  "id": 16243735,
  "title": "Designing a reverse proxy that survives a Plex SSRF",
  "url": "https://urgent.news/2026/10/23/designing-a-reverse-proxy-that-survives-a-plex-ssrf",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-23T23:20:37.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/sorrelthorncroft/designing-a-reverse-proxy-that-survives-a-plex-ssrf-pal"
  },
  "original_language": "en",
  "account": "Designing a reverse proxy that survives a Plex SSRF A server-side request forgery in Plex can be mitigated using a reverse proxy, but it is not a foolproof solution. The vulnerability is exploitable via the /video/:/transcode/universal path parameter by an authenticated user. To enhance security, start by listing the endpoints your users actually call and remove any unnecessary ones at the proxy level. Denying requests from outside trusted networks to this specific endpoint while allowing it for local clients can maintain playback functionality while blocking external access. Controlling the upstream by implementing egress filtering on the Plex host or container level can limit the potential damage. For Docker deployments, ensure the container has restricted network access to prevent lateral movement. Account hygiene is crucial as the vulnerability requires authentication. Regularly review and remove unnecessary accounts, and consider disabling account creation without approval. While reverse proxy rules can reduce the attack surface, they do not fix the vulnerability. They only limit one handler and the second hop. If the endpoint is allowed locally, the rules may not apply, and encoded slashes or case differences can defeat naive path rules. After applying proxy rules, verify from an external network that the endpoint returns a rejection and from the local network that playback still works. Confirm that outbound requests to link-local addresses fail at the host level. Ultimately, patching the vulnerability is the most comprehensive solution.",
  "summary": "Designing a reverse proxy that survives a Plex SSRF Most guidance for CVE-2026-96655 ends at \"upgrade to 1.43.3.10861\". That is correct and sufficient for many owners. For the ones who cannot upgrade on the day the advisory lands, the question becomes what a proxy layer can realistically stop. The flaw is a server-side request forgery reachable by an authenticated user through the…",
  "key_points": [
    "Server-side request forgery in Plex mitigated using reverse proxy",
    "Endpoint exploitation via /video/:/transcode/universal path parameter",
    "Patching vulnerability is most comprehensive solution"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}