Security researcher Malcolm Stagg has disclosed a new attack class called NatJack that manipulates network address translation (NAT) connection state to hijack active TCP sessions, spoof DNS responses, expose mapped ports, and exhaust NAT tables. Presented at Black Hat USA 2026, the research found a
Security researcher Malcolm Stagg has pulled back the curtain on a nasty new attack class called NatJack, and it's the kind of thing that keeps network admins up at night. Simply put, NatJack messes with the connection state inside network address translation (NAT) tables to hijack live TCP sessions, spoof DNS responses, expose mapped ports, and even flood NAT tables until they're completely exhausted. It's not a single trick, either—it's a whole toolkit for breaking the trust baked into how networks talk to each other.
Stagg presented his findings at Black Hat USA 2026, and the research paints a sobering picture. He tested multiple independently developed NAT implementations—including ones found in Windows and other major systems—and saw the same vulnerable behavior popping up across the board. That's the scary part: this isn't a vendor-specific bug you can patch and forget. It's a fundamental weakness in how NAT handles state, which means the fix is going to require some serious rethinking.
### What Exactly Is NatJack Doing?
Let's break it down without getting too deep into the weeds. NAT tables are basically the memory banks that keep track of which internal device is talking to which external server. When you send a request out to the internet, your router notes the connection so replies know where to go. NatJack exploits that mechanism by injecting fake packets that trick the NAT into thinking a connection has changed state—maybe it's closed, maybe it's rerouted, maybe it's something else entirely.
Once the attacker gets that foothold, the damage can spread fast:
- **TCP session hijacking:** An attacker can take over an active session, like a logged-in banking portal, and ride it as if they were you.
- **DNS spoofing:** By poisoning the NAT's DNS handling, they can redirect you to lookalike sites that steal credentials or serve malware.
- **Port exposure:** Mapped ports that should be hidden can be revealed, giving attackers a direct path into internal services.
- **Table exhaustion:** Flooding the NAT table with bogus entries can knock the network offline entirely—a quick and dirty denial-of-service attack.
### Why Should You Care?
If you're running a business network, a home office, or even just a smart home with a bunch of connected devices, your NAT is the gatekeeper. When that gatekeeper gets fooled, everything behind it is fair game. The scary part is that this attack doesn't require physical access or some exotic setup—it can be launched remotely, and it targets the very infrastructure that's supposed to keep you safe.
Stagg's work highlights a broader truth: NAT was never designed with security in mind. It was a practical solution to an IP address shortage, and we've been leaning on it for protection ever since. NatJack is a reminder that relying on NAT as a security boundary is a bit like using a screen door on a submarine—it works until it doesn't.
### What Can You Do About It?
There's no magic bullet yet, but there are steps you can take to reduce your exposure. First, keep your routers and firewalls updated, since vendors will likely start shipping patches for known implementations. Second, consider moving to IPv6 where possible, since it reduces reliance on NAT altogether. And third, don't put all your trust in the perimeter—use end-to-end encryption like TLS for sensitive traffic, so even if a session gets hijacked, the attacker can't read what's inside.
For the security community, NatJack is a wake-up call. It's a reminder that the protocols and devices we take for granted are often held together with duct tape and good intentions. Stagg's disclosure gives defenders a head start, but the real work begins now—testing, patching, and rethinking how we build network trust from the ground up.
