# UNDF: UNDF-2026-000000095
diff --git a/pylib/gyp/input.py b/pylib/gyp/input.py
index 4c12891..8ad96a6 100644
--- a/pylib/gyp/input.py
+++ b/pylib/gyp/input.py
@@ -1600,16 +1600,20 @@ class DependencyGraphNode(object):
     results = []
     visited = set()
 
-    def Visit(node, path):
+    def Visit(node, path, path_set):
       for child in node.dependents:
-        if child in path:
+        # CWE-407 fix: use path_set for O(1) membership test.
+        # path list is kept only for cycle extraction (path.index).
+        if child in path_set:
           results.append([child] + path[:path.index(child) + 1])
         elif not child in visited:
           visited.add(child)
-          Visit(child, [child] + path)
+          path_set.add(child)
+          Visit(child, [child] + path, path_set)
+          path_set.discard(child)
 
     visited.add(self)
-    Visit(self, [self])
+    Visit(self, [self], {self})
 
     return results