# UNDF: UNDF-2026-000000041
--- a/syncapi/storage/shared/storage_consumer.go
+++ b/syncapi/storage/shared/storage_consumer.go
@@ -238,14 +238,15 @@ func (d *Database) updateRoomIDsWithEventTypes(ctx context.Context, txn *sql.Tx
 	prevEvents, err := d.OutputEvents.SelectEvents(ctx, txn, ev.PrevEventIDs(), nil, false)
 	if err != nil {
 		return err
 	}
-	var found bool
-	for _, eID := range ev.PrevEventIDs() {
-		found = false
-		for _, prevEv := range prevEvents {
-			if eID == prevEv.EventID() {
-				found = true
-			}
-		}
-		// If the event is missing, consider it a backward extremity.
-		if !found {
+	// CWE-407 fix: pre-build a set of fetched event IDs for O(1) lookup
+	// instead of O(P*E) double loop (P=prevEventIDs count, E=fetched events count).
+	prevEventSet := make(map[string]bool, len(prevEvents))
+	for _, prevEv := range prevEvents {
+		prevEventSet[prevEv.EventID()] = true
+	}
+	for _, eID := range ev.PrevEventIDs() {
+		// If the event is missing from storage, consider it a backward extremity.
+		if !prevEventSet[eID] {
 			if err = d.BackwardExtremities.InsertsBackwardExtremity(ctx, txn, ev.RoomID().String(), ev.EventID(), eID); err != nil {
 				return err
 			}