A newly disclosed attack class called NatJack exploits how network address translation (NAT) devices track connection state, allowing an attacker to hijack active TCP sessions, spoof DNS responses, expose internally mapped ports, and exhaust NAT tables entirely. The research was presented by security researcher Malcolm Stagg at Black Hat USA 2026.

NAT is a foundational networking function used by home routers, enterprise firewalls, cloud gateways, and carrier-grade infrastructure to translate private IP addresses to public ones and track the state of outbound connections. NatJack targets the logic that manages this state, manipulating NAT tables in ways that were not anticipated by the implementations tested.

What NatJack Can Do

According to the disclosure, the attack class enables several distinct outcomes depending on how it is applied:

  • TCP session hijacking: Manipulating NAT state to insert an attacker into an already established TCP connection.
  • DNS response spoofing: Abusing NAT mapping behavior to inject forged DNS responses into a victim’s traffic.
  • Mapped port exposure: Revealing internal port mappings that are normally hidden behind the NAT boundary, potentially aiding follow-on reconnaissance or attacks.
  • NAT table exhaustion: Flooding or manipulating the NAT state table until it is exhausted, degrading or denying network connectivity for legitimate traffic.

Broad, Cross-Vendor Impact

Notably, the research found that this class of behavior is not confined to a single vendor or codebase. Independently developed NAT implementations were shown to be affected, including on Windows, suggesting the underlying weakness stems from assumptions common across how NAT state tracking has traditionally been designed rather than a bug in any single product.

Because NAT sits at a critical trust boundary between private networks and the internet, weaknesses in its state-tracking logic can have outsized consequences, potentially undermining assumptions that internal hosts and their connections are shielded from external manipulation.

Security teams responsible for routers, firewalls, and gateway infrastructure should watch for vendor guidance and patches addressing NAT state-handling behavior, and should monitor for unusual DNS responses, unexpected session resets, or NAT table pressure as potential indicators of exploitation attempts.