Plex Tells Server Owners to Install Security Update Now
Plex has released Media Server 1.43.3 and Plex Desktop 1.115.0 for multiple security issues. NAS users may need to install the package manually if their device's app store has not caught up.
The short version
What you need to know
- Plex says Media Server 1.43.3 and Plex Desktop 1.115.0 address multiple security issues and recommends updating as soon as possible.
- The company has requested CVE identifiers but has not yet published technical details, so readers should not infer a specific exploit path or assume their server was compromised.
- Check the version that is actually running. NAS package managers may lag, while Docker users need to refresh and redeploy the maintained image according to their setup.
What has Plex announced?
Plex says it released Plex Media Server 1.43.3 and Plex Desktop 1.115.0 to address a number of security issues. Its notice applies to Plex Media Server 1.43.2 and earlier and recommends that server owners and Desktop users update promptly.
Plex says CVE identifiers have been requested and that it will add details to the announcement once they are published. Until then, the notice confirms fixes and affected version boundaries but does not support claims about the exact vulnerabilities, attack prerequisites or exploitation status.
Why home-server owners should act
A media server often stores a private library, account tokens and information about devices or users. Some installations are reachable remotely, and a server may also run on a NAS that holds unrelated files. That makes prompt updates and limited exposure important even before full vulnerability details arrive.
Updating is not evidence that an older server was attacked. Owners should avoid panic and check facts: identify the installed version, confirm whether remote access is enabled, review recent sign-ins and devices, and use Plex's later CVE details to decide whether additional investigation is needed.
How to check NAS, desktop and Docker installs
Windows users with automatic updates should confirm they are on Media Server 1.43.3 or newer. Plex provides manual packages for macOS and Linux. The company warns that updated NAS packages may not yet appear in every manufacturer's package manager, but they can be installed manually using the official Plex download and the NAS vendor's procedure.
For Docker, follow the maintained Plex image instructions for your deployment, pull the current image and recreate the container while preserving the documented configuration and media mounts. For Plex Desktop, confirm version 1.115.0 or newer through the application's official update path.
Where a VPN helps — and where it does not
A properly configured remote-access VPN can let a household reach a private home service without exposing that service directly to the public internet. That is an administrative design choice and still requires authentication, firewall rules, updates and careful routing.
A consumer VPN app does not patch Plex, upgrade a NAS package, secure a misconfigured port or remove an attacker who already obtained access. Patch the server first, reduce unnecessary internet exposure and review account or server activity if the later technical details indicate your installation was at risk.
VPN Rocks view
Home streaming infrastructure deserves the same maintenance discipline as a laptop or router. Auto-update settings can fail, NAS stores can lag and containers do not replace themselves just because a new image exists.
The practical habit is simple: know where Plex runs, know whether it is reachable from outside the home and verify the running version after every security notice. Do not substitute a VPN subscription for software maintenance.
Primary reading
Sources and further reading
We add plain-English context and practical advice. These links let you inspect the underlying reporting, research and official guidance directly.
