NatJack Vulnerability Exposes Fundamental Trust Flaw in Shared NAT Infrastructure

Security researcher Malcolm Stagg disclosed a new class of network attacks dubbed "NatJack" at Black Hat USA 2026, revealing a critical vulnerability in how devices handle shared network boundaries. The flaw allows an attacker to manipulate Network Address Translation (NAT) connection tracking tables to compromise other users on the same network.

According to Stagg, NatJack enables an adversary sharing a NAT boundary with a victim to hijack active TCP sessions, poison DNS responses, and trigger denial-of-service (DoS) events. The attack comprises four primary techniques: TCP connection hijacking, DNS response poisoning, connection port identification, and NAT table exhaustion. Testing confirmed that the vulnerability is not a simple coding error but a fundamental design flaw affecting NAT implementations across macOS, Linux, and Windows.

The Trust Gap in NAT

NAT was originally developed in the 1990s as a temporary solution to IPv4 address exhaustion rather than a security mechanism. While previous exploits like NAT Pinning in 2010 and NAT Slipstreaming in 2020 required specific conditions or victim interaction, NatJack is distinct because it manipulates the NAT table directly. It requires no action from the victim other than maintaining an active connection through the shared NAT infrastructure. Stagg attributed the issue to under-specification in early RFCs, which allowed behaviors based on the assumption that peers sharing a network could be trusted.

Industry Implications

Because the vulnerability targets Layer 3 and Layer 4 shared NAT infrastructure, traditional network defenses are ineffective. Stagg noted that neither switch port isolation nor VLAN segmentation provides protection against these attacks. While the widespread adoption of end-to-end encryption via TLS prevents attackers from reading the contents of hijacked data, it does not stop the hijacking process itself. Attackers can still terminate connections or disrupt unencrypted traffic, leaving critical infrastructure and legacy systems exposed.

What's Next

The discovery has already prompted responses from major OS vendors, though the path to remediation varies. Network World reports that the Linux kernel security team initially dismissed the findings as "totally bogus" before eventually issuing a patch at the request of Microsoft. As organizations evaluate their internal network boundaries, the focus will likely shift toward reducing reliance on shared NAT trust models and accelerating the transition to more robust addressing architectures.