AIKIDO-2026-837633

TL;DR

The traversal engine processes a node's sibling list by recursing on the tail and then calling List.flatten over the already flattened result, so each of n siblings copies and re-walks the entire remaining tail. This makes traversal quadratic in the number of siblings, and the traverser runs on every public entry point regardless of which scrubber is used. Sanitizing HTML that contains a large flat run of allowed sibling elements exhausts CPU and memory and can make the service unresponsive. The fix removes the redundant re-flattening so traversal cost is linear.