A query is likely too expensive when it returns many unintended combinations, especially across sibling nodes or repeated elements. The article shows that broad adjacency queries can produce exponential matches and push runtimes into seconds on modest HTML inputs. That is a strong signal to narrow the query or move relationship logic into code.
How to recognise a query that is already crossing the performance line
The clearest warning sign is not just that a query matches more often, but that it creates many unintended combinations as the tree gets larger. That usually happens when the pattern is too broad about adjacency, repetition, or sibling relationships, so the engine has to explore a large search space rather than a narrow structural path. If the query feels “expressive” but becomes slow on ordinary documents, the shape of the pattern is probably the problem.
Another practical signal is growth that looks worse than linear. A query that is fine on small samples but suddenly becomes expensive when the number of repeated nodes increases is usually doing multiplicative work, not simple filtering. In tree-sitter terms, this often shows up when the same logical relationship is rediscovered across many branches instead of being constrained by a tighter anchor node.
For a broader engineering view of query and access complexity, it helps to think in terms of structural constraints rather than raw match counts. When a pattern can match the same content through many equivalent paths, the runtime cost rises fast even if the final result set is not especially useful. That is why relationship logic often belongs in code after a narrower query has identified the candidate nodes.
What expensive tree-sitter queries usually look like in practice
Expensive queries tend to share a few traits: they search across siblings instead of down a single branch, they repeat optional constructs in a way that multiplies combinations, or they ask the engine to infer a relationship that is easier to compute procedurally. The key issue is not whether the query is syntactically valid, but whether each extra node in the pattern materially increases the number of candidate matches.
- Broad sibling matching that combines many adjacent nodes.
- Repeated patterns that allow the same text to satisfy the query in multiple ways.
- Loose structural anchors, especially in large HTML, markdown, or generated documents.
- Queries that are used as a stand-in for business logic, deduplication, or ordering.
When those patterns appear, the cost often hides until the query is run against large corpora or documents with many repeated elements. At that point, what looked like a neat declarative rule becomes a combinatorial search problem. If the runtime jumps from milliseconds to seconds on modest inputs, the query shape deserves immediate review.
One useful comparison is to treat the query as a filter, not a full decision engine. The query should identify a plausible structural slice of the tree, and the surrounding code should handle the expensive reasoning about relationships, uniqueness, and downstream selection. That separation usually produces a more predictable and maintainable parser pipeline.
Practical response when a query starts to scale poorly
The first step is to narrow the structural anchor so the engine starts from a smaller, more specific node set. From there, simplify repeated relationships and remove any pattern that is only present to discover all possible combinations. If a query is generating duplicate or near-duplicate matches, it is often better to accept a smaller candidate set and resolve the rest in code.
What to verify: Test the query against documents that reflect real size and repetition, not just a toy example. Measure whether runtime rises faster than the input size and whether the same logical result is being rediscovered through multiple paths.
Common mistake: Treating every match as useful. In practice, many slow queries are slow because they are matching too much structure, not because the underlying tree-sitter engine is inherently inefficient.
Practitioner takeaway: If the query becomes expensive as repetition increases, the right fix is usually to reduce the search space, not to hope the engine will optimise away an overly broad structural pattern.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | 8 — Audit Log Management | Tree-sitter query costs should be measured to spot abnormal runtime growth. |
| 16 — Application Software Security | The issue is a software performance and correctness problem in parsing logic. | |
| Recommendation — Measure query runtime and match volume to detect patterns that scale poorly. Review parser rules for overly broad structural patterns before deploying them at scale. | ||
| NIST CSF 2.0 | DE.CM — Continuous Monitoring | Slow queries are operational signals that need ongoing monitoring in production use. |
| Recommendation — Monitor parser performance and alert when query latency or match counts spike. | ||
Related resources from NHI Mgmt Group
- What are the signs that an observability platform is becoming too expensive to sustain at scale?
- When does DAST become too expensive to scale effectively?
- When does AI-assisted triage become too expensive to run autonomously?
- What signals show that an AI model is becoming too expensive to run in production?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
