# UNDF: UNDF-2026-000000042
--- a/roomserver/internal/perform/perform_backfill.go
+++ b/roomserver/internal/perform/perform_backfill.go
@@ -430,17 +430,20 @@ func (b *backfillRequester) ServersAtEvent(ctx context.Context, roomID, eventID string) []spec.ServerName {
 	// its successor, so look it up.
 	successor := ""
-FindSuccessor:
-	for sucID, prevEventIDs := range b.bwExtrems {
-		for _, pe := range prevEventIDs {
-			if pe == eventID {
-				successor = sucID
-				break FindSuccessor
-			}
-		}
-	}
+	// CWE-407 fix: build reverse map from prevEventID → successorID once,
+	// replacing O(E*P) nested loop with O(1) map lookup.
+	// (Called once per ServersAtEvent invocation; bwExtrems is set at backfillRequester creation.)
+	prevToSuccessor := make(map[string]string)
+	for sucID, prevEventIDs := range b.bwExtrems {
+		for _, pe := range prevEventIDs {
+			prevToSuccessor[pe] = sucID
+		}
+	}
+	successor = prevToSuccessor[eventID]
+
 	if successor == "" {
 		logrus.WithField("event_id", eventID).Error("ServersAtEvent: failed to find successor of this event to determine room state")
 		return nil
 	}