Security researcher Malcolm Stagg has disclosed a novel class of attacks, dubbed NatJack, which exploits vulnerabilities in Network Address Translation (NAT) implementations to achieve various malicious outcomes. The research, presented at Black Hat USA 2026, details how these attacks can manipulate NAT connection state to hijack active TCP sessions, spoof DNS responses, expose internal mapped ports, and potentially exhaust NAT tables, leading to denial-of-service conditions.
The core mechanism of NatJack attacks involves manipulating the internal connection state maintained by NAT devices. When a NAT device translates private IP addresses and port numbers to public ones, it keeps a record of these mappings to ensure return traffic is routed correctly. NatJack exploits how some NAT implementations handle the creation and modification of these state entries. By sending specially crafted packets, an attacker can trick the NAT device into creating or altering existing translation entries, thereby redirecting traffic or associating legitimate connections with attacker-controlled endpoints.
One significant impact of NatJack is the ability to hijack active TCP sessions. An attacker could, for instance, inject packets into an ongoing connection by manipulating the NAT state to redirect subsequent packets of a legitimate session through an attacker-controlled host. This could allow for data interception, modification, or even full session takeover. Another reported capability is DNS spoofing, where an attacker could manipulate NAT tables to redirect DNS queries to a malicious server, leading to users being directed to phishing sites or receiving incorrect resource records.
The research also highlighted the potential for exposing mapped ports. NAT devices often perform port mapping to allow external access to internal services. NatJack could potentially exploit NAT state manipulation to reveal or alter these mappings, making internal services unexpectedly accessible or redirecting legitimate external access to an attacker. Furthermore, by rapidly creating and modifying NAT entries, an attacker could exhaust the NAT table resources, leading to a denial-of-service condition for all devices behind the NAT, as new connections would be unable to be established.
The findings are particularly concerning because the affected behavior was observed across independently developed NAT implementations. While specific vendors were not detailed beyond mentioning Windows, this suggests that the underlying vulnerabilities might stem from common design patterns or assumptions in how NAT state is managed, rather than isolated bugs in a single product. This broad applicability indicates a potentially widespread issue across various network devices and operating systems that implement NAT functionality.
Mitigation for this class of attack would typically involve robust validation of incoming packets before updating NAT connection state. Implementations should carefully scrutinize source and destination addresses, port numbers, and TCP sequence numbers to prevent unauthorized modification or creation of state entries. Regular patching of network devices and operating systems is crucial, as vendors release updates to address such vulnerabilities. Network administrators should also consider implementing stricter firewall rules and intrusion detection systems that can flag unusual NAT table activity.
The disclosure of NatJack underscores the ongoing challenges in securing fundamental network infrastructure components. As NAT remains a ubiquitous technology for conserving IPv4 addresses and providing a basic layer of network segmentation, vulnerabilities that manipulate its core functionality can have far-reaching implications. This research serves as a reminder that even long-standing and widely deployed technologies can harbor subtle flaws that, when exploited, can undermine network security and user privacy.
