# UNDF: UNDF-2026-000000861
--- a/apps/web/src/utils/arrays.ts
+++ b/apps/web/src/utils/arrays.ts
@@ -189,8 +189,12 @@ export function arrayHasOrderChange(a: any[], b: any[]): boolean {
 export function arrayDiff<T>(a: T[], b: T[]): Diff<T> {
+    // CWE-407 fix: use Set for O(1) membership test instead of O(A*B)
+    // includes() inside filter(). Build Sets once, then filter.
+    const setA = new Set(a);
+    const setB = new Set(b);
     return {
-        added: b.filter((i) => !a.includes(i)),
-        removed: a.filter((i) => !b.includes(i)),
+        added: b.filter((i) => !setA.has(i)),
+        removed: a.filter((i) => !setB.has(i)),
     };
 }

@@ -202,7 +206,10 @@ export function arrayDiff<T>(a: T[], b: T[]): Diff<T> {
  * @returns The intersection of the arrays.
  */
 export function arrayIntersection<T>(a: T[], b: T[]): T[] {
-    return a.filter((i) => b.includes(i));
+    // CWE-407 fix: use Set for O(1) membership test instead of O(A*B)
+    // includes() inside filter().
+    const setB = new Set(b);
+    return a.filter((i) => setB.has(i));
 }