# UNDF: UNDF-2026-000000338
diff --git a/lib/hmr/JavascriptHotModuleReplacement.runtime.js b/lib/hmr/JavascriptHotModuleReplacement.runtime.js
index xxxxxxx..xxxxxxx 100644
--- a/lib/hmr/JavascriptHotModuleReplacement.runtime.js
+++ b/lib/hmr/JavascriptHotModuleReplacement.runtime.js
@@ -26,7 +26,8 @@ module.exports = function () {
 		function getAffectedModuleEffects(updateModuleId) {
-			var outdatedModules = [updateModuleId];
+			// CWE-407 fix: use Set for O(1) membership checks in BFS traversal.
+			var outdatedModulesSet = new Set([updateModuleId]);
+			var outdatedModules = [updateModuleId]; // kept for ordered result only
 			var outdatedDependencies = {};

 			var queue = outdatedModules.map(function (id) {
@@ -70,9 +71,9 @@ module.exports = function () {
 				for (var i = 0; i < module.parents.length; i++) {
 					var parentId = module.parents[i];
 					var parent = $moduleCache$[parentId];
 					if (!parent) continue;
 					if (parent.hot._declinedDependencies[moduleId]) {
 						return { type: "declined", chain: chain.concat([parentId]),
 						         moduleId: moduleId, parentId: parentId };
 					}
-					if (outdatedModules.indexOf(parentId) !== -1) continue;
+					if (outdatedModulesSet.has(parentId)) continue;
 					if (parent.hot._acceptedDependencies[moduleId]) {
 						if (!outdatedDependencies[parentId])
 							outdatedDependencies[parentId] = [];
@@ -81,6 +82,7 @@ module.exports = function () {
 					}
 					delete outdatedDependencies[parentId];
 					outdatedModules.push(parentId);
+					outdatedModulesSet.add(parentId);
 					queue.push({ chain: chain.concat([parentId]), id: parentId });
 				}
 			}
@@ -96,11 +98,12 @@ module.exports = function () {
 		}

 		function addAllToSet(a, b) {
 			for (var i = 0; i < b.length; i++) {
 				var item = b[i];
-				if (a.indexOf(item) === -1) a.push(item);
+				if (!a._set) a._set = new Set(a);
+				if (!a._set.has(item)) { a.push(item); a._set.add(item); }
 			}
 		}