# UNDF: UNDF-2026-000000860
--- a/apps/web/src/TextForEvent.tsx
+++ b/apps/web/src/TextForEvent.tsx
@@ -394,8 +394,11 @@ function textForCanonicalAliasEvent(ev: MatrixEvent): (() => string) | null {
     const oldAltAliases = ev.getPrevContent().alt_aliases || [];
     const newAlias = ev.getContent().alias;
     const newAltAliases = ev.getContent().alt_aliases || [];
-    const removedAltAliases = oldAltAliases.filter((alias: string) => !newAltAliases.includes(alias));
-    const addedAltAliases = newAltAliases.filter((alias: string) => !oldAltAliases.includes(alias));
+    // CWE-407 fix: use Set for O(1) membership test; avoids O(A*B) from
+    // includes() inside filter() when computing alias diffs.
+    const newAltAliasSet = new Set(newAltAliases);
+    const oldAltAliasSet = new Set(oldAltAliases);
+    const removedAltAliases = oldAltAliases.filter((alias: string) => !newAltAliasSet.has(alias));
+    const addedAltAliases = newAltAliases.filter((alias: string) => !oldAltAliasSet.has(alias));

     if (!removedAltAliases.length && !addedAltAliases.length) {
         if (newAlias) {