NatJack: A New Way to Hijack Internet Traffic by Poisoning Router Memory
Researcher Malcolm Stagg says routers from Microsoft to Linux mishandle connection tracking in ways that let attackers steal live sessions and forge DNS replies.
Key points
- Security researcher Malcolm Stagg disclosed a new attack class called NatJack at Black Hat USA 2026.
- NatJack manipulates the memory routers use to track connections, letting attackers hijack live TCP sessions and forge DNS replies.
- The behaviour appeared in independently built products, including Windows and Linux-based devices.
- Reported impacts include exposing mapped ports and filling up NAT tables so devices stop working.
- The findings point to a design-level weakness, not a single vendor bug.
A researcher has found a way to trick home and office routers into handing attackers control of internet traffic that is already flowing through them.
Malcolm Stagg calls the technique NatJack. He presented it at Black Hat USA 2026, and the write-up was first flagged by The Hacker News. What makes it unusual is that the same weakness turned up in products built by different companies, using different code, which suggests the problem sits in how the technology itself was designed rather than in one vendor's mistake.
What is NatJack, in plain words?
NatJack is an attack that abuses the little notebook every router keeps, listing who inside your network is talking to what on the outside. By poisoning entries in that notebook, an attacker can quietly redirect or take over conversations that are already in progress.
The notebook has a technical name: a NAT table. NAT stands for network address translation, and it is the trick that lets many devices in your home or office share one public internet address. Your router remembers which laptop asked for which website, so the reply gets back to the right machine.
Stagg's research shows that if an attacker can nudge the right entries in that table, they can do four nasty things.
What can an attacker actually do?
Four things, according to the research. They range from spying on a single connection to knocking a whole network offline.
| Attack outcome | What it means for a normal user |
|---|---|
| TCP session hijack | An attacker takes over a live connection, such as a logged-in web session |
| DNS spoofing | Forged replies send your browser to a fake site when you type a real address |
| Port exposure | Services meant to stay inside the network get opened to the internet |
| NAT table exhaustion | The router's notebook fills up, and connections start failing |
TCP is the basic delivery system for most internet traffic, the thing that keeps a video call or a bank login glued together. DNS is the phonebook that turns names like yourbank.com into the numeric address your device actually dials. Both are being manipulated here without the attacker needing to break any password.
Which devices are affected?
Stagg tested devices running Windows and Linux, and the flawed behaviour showed up in both. That is the detail worth pausing on.
When the same class of weakness appears in code bases written independently, it usually means the specification or the common design pattern is at fault, not one team's sloppy work. In practical terms, that means fixes will need to come from many vendors, not just one patch on Patch Tuesday.
Stagg has not, at the time of writing, tied the research to a single CVE identifier covering every affected product. Expect vendor-specific advisories to follow.
Should ordinary users be worried?
Not in a panic sense, but yes in a keep-your-router-updated sense. NatJack is not something a random scammer will run against your home tomorrow. It is the kind of technique that shows up first in targeted work, then trickles down into wider tooling over the following months.
The practical steps are dull and familiar. Install router firmware updates when your provider pushes them. Replace hardware that no longer receives updates. On corporate networks, ask whether the firewall or gateway vendor has commented on NatJack.
For the security community, the bigger story is that a piece of plumbing almost every network relies on has just been shown to have a shared blind spot. Expect follow-up research.
