Security researcher Malcolm Stagg has disclosed a new attack class called NatJack that exploits how network address translation (NAT) devices manage connection states. The attack hijacks active TCP sessions, spoofs DNS responses, exposes mapped ports, and exhausts NAT table resources across multiple operating systems including Windows.
NatJack operates by manipulating the connection state tracking tables that NAT devices maintain. These tables map internal network addresses to external ones, enabling devices behind a firewall to communicate with external networks. By crafting malicious packets, attackers can inject false entries into these tables or modify existing connections without proper authentication or validation.
The attack delivers multiple damage vectors. Session hijacking allows threat actors to intercept and redirect established TCP connections, potentially capturing sensitive data or injecting malicious commands. DNS spoofing capabilities enable attackers to redirect users to fraudulent websites or intercept credentials. Port exposure reveals which internal services are accessible through the NAT device, expanding the attack surface. NAT table exhaustion creates a denial-of-service condition by filling the device's connection tracking memory, preventing legitimate users from establishing new connections.
Stagg's research, presented at Black Hat USA 2026, demonstrates the vulnerability affects independently developed NAT implementations across multiple platforms. This broad impact suggests the vulnerability stems from fundamental design weaknesses in how NAT devices validate connection state changes rather than isolated implementation flaws.
Organizations operating behind NAT devices face elevated risk. Small business networks, home offices, and enterprises using NAT firewalls should evaluate their vendor's security posture. Network administrators should check for firmware updates addressing connection state validation. In high-risk environments, deploying additional network segmentation and intrusion detection systems monitoring for suspicious connection patterns provides additional defense layers.
Individual users should update home router firmware promptly when available and consider additional DNS security measures. The attack requires network proximity, limiting exploitation to local network segments or networks