NatJack: A New Way to Hijack Internet Traffic by Poisoning Router Memory
Researcher Malcolm Stagg says routers running Windows and Linux mishandle connection tracking in ways that let attackers steal live sessions and forge DNS replies.
Key points
- Security researcher Malcolm Stagg disclosed a new attack class called NatJack at Black Hat USA 2026.
- NatJack manipulates the memory routers use to track connections, letting attackers hijack live TCP sessions and forge DNS replies.
- The behaviour appeared in independently developed Windows and Linux implementations.
- Reported impacts include exposing mapped ports and filling NAT tables until devices stop accepting connections.
- The findings point to a design-level weakness, not a single vendor bug.
A researcher has found a way to trick home and office routers into handing attackers control of internet traffic that's already flowing through them.
Malcolm Stagg calls the technique NatJack. He presented it at Black Hat USA 2026, and The Hacker News first flagged the write-up. What makes it unusual is that the same weakness turned up in products built by different companies using different code, which suggests the problem sits in how the technology itself was designed rather than in one vendor's mistake.
What is NatJack, in plain words?
NatJack abuses the little notebook every router keeps, listing who inside your network is talking to what on the outside. By poisoning entries in that notebook, an attacker can quietly redirect or take over conversations already in progress.
That notebook has a technical name: a NAT table. NAT stands for network address translation, the trick that lets many devices in your home or office share one public internet address. Your router remembers which laptop asked for which website so the reply gets back to the right machine. Stagg's work shows that nudging the right entries in that table opens four avenues for an attacker.
What can an attacker actually do?
Four things, according to the research. They range from spying on a single connection to knocking a whole network offline.
| Attack outcome | What it means for a normal user |
|---|---|
| TCP session hijack | An attacker takes over a live connection, such as a logged-in web session |
| DNS spoofing | Forged replies send your browser to a fake site when you type a real address |
| Port exposure | Services meant to stay inside the network get opened to the internet |
| NAT table exhaustion | The router's notebook fills up and connections start failing |
TCP is the basic delivery system for most internet traffic, the protocol that keeps a video call or a bank login glued together. DNS is the phonebook that turns names like yourbank.com into the numeric address your device actually dials. Both are manipulated here without the attacker needing a password.
Which devices are affected?
Stagg tested devices running Windows and Linux, and the flawed behaviour appeared in both. That's the detail worth pausing on.
When the same class of weakness turns up in code bases written independently, it usually means the specification or the common design pattern is at fault, not one team's sloppy work. Fixes will need to come from many vendors, not a single patch. Our 5 August report on 15 flaws in TP-Link's Omada system showed how quickly a shared architectural assumption becomes everybody's problem at once.
Stagg hasn't tied the research to a single CVE identifier covering every affected product. Vendor-specific advisories should follow.
Should ordinary users be worried?
Not in a panic sense, but yes in a keep-your-router-updated sense. NatJack isn't something a random scammer will run against your home tomorrow. It's the kind of technique that appears first in targeted operations, then works its way into wider tooling over the following months.
The practical steps are dull and familiar. Install router firmware updates when your provider pushes them. Replace hardware that no longer receives updates. On corporate networks, ask whether the firewall or gateway vendor has commented on NatJack.
For the security community, the bigger story is that a piece of plumbing almost every network relies on has a shared blind spot that wasn't obvious until one researcher went looking. Medium confidence that follow-up research lands before the end of the year.
