java-topology/whitepaper/outreach/jitsi-meet-0004.md

Jitsi Meet — CWE-407 Disclosure Brief (jitsi-meet-0004)

2026-04-13 · Patch available — awaiting upstream merge

Finding

One O(VU) defect in Jitsi Meet's visitors list management. Delta updates (join/leave events) use Array.findIndex() and Array.filter() on the full visitors array for each update, producing O(VU) total cost where V = visitors and U = updates per batch.

The Defect

jitsi-meet-0004 (PATCHED — MEDIUM): react/features/visitors/middleware.ts:385

// Delta updates callback:
updates.forEach(u => {
    if (u.s === 'j') {
        const index = visitors.findIndex(v => v.id === u.r);  // O(V) per update
        if (index === -1) { visitors.push({...}); }
        else { visitors[index] = {...}; }
    } else if (u.s === 'l') {
        visitors = visitors.filter(v => v.id !== u.r);  // O(V) per update
    }
});

Each join/leave delta update scans or filters the entire visitors array. With U updates per batch and V visitors, total cost reaches O(V*U). Large conferences with hundreds of visitors and frequent join/leave activity accumulate quadratic overhead.

Complexity Proof

At V=500 visitors, U=50 updates per batch:

• Defective: 50 × 500 = 25,000 comparisons per batch
• Fixed: 50 × O(1) Map operations + O(V) array conversion = ~550 operations
• ~45× op reduction.

Impact

Jitsi Meet supports large conferences with visitor mode. Visitors join and leave frequently, generating batches of delta updates. Each batch triggers quadratic processing on the visitors list, affecting UI responsiveness in the browser.

The Fix

Rebuild visitors as a Map<string, {id, name}> for O(1) per-update operations, converting back to array once per batch:

// After
const visitorsMap = new Map(
    (visitors ?? []).map(v => [v.id, v])
);
for (const u of updates) {
    if (u.s === 'j') { visitorsMap.set(u.r, {id: u.r, name: u.n}); }
    else if (u.s === 'l') { visitorsMap.delete(u.r); }
}
dispatch(updateVisitorsList(Array.from(visitorsMap.values())));

Patch

Fix available: defects/jitsi-meet-0004/patch/jitsi-meet-0004-visitors-map-dedup.patch

Single-file patch in middleware.ts. ~45× speedup at 500 visitors with 50 updates.

What We Ask

A patch is ready for review.

1. Confirm receipt and assign a GitHub issue reference (jitsi/jitsi-meet).
2. Assess severity — fires on every visitor delta update batch in large conferences.
3. Coordinate a disclosure date — we are targeting 90 days from first contact.
4. We will credit the Jitsi team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.