diff --git a/css/handlers.go b/css/handlers.go
index 6550d10..23370c6 100644
--- a/css/handlers.go
+++ b/css/handlers.go
@@ -337,16 +337,46 @@ func multiSplit(value string, seps ...string) []string {
 	return curArray
 }
 
+// recursiveCheck reports whether value can be fully consumed by
+// partitioning it, in order, into one or more contiguous groups of
+// tokens such that every group is accepted by at least one function in
+// funcs.
+//
+// The search is memoized on the length of the remaining suffix. Every
+// recursive call is made on value[i+1:], which is always a suffix of
+// the slice originally passed in, and since funcs is constant across
+// the whole search, the outcome for a given suffix depends only on how
+// many tokens remain in it. Without caching that outcome, the same
+// suffix can be re-explored once for every distinct partition path that
+// reaches it, which is exponential in len(value) whenever a value has
+// several tokens that multiple funcs accept on their own (for example
+// runs of whitespace, which some handlers treat as a valid empty
+// entry). Caching means each of the at most len(value) distinct
+// suffixes is solved once, turning that exponential search into a
+// polynomial one without changing which values are ultimately accepted
+// or rejected.
 func recursiveCheck(value []string, funcs []func(string) bool) bool {
+	memo := make(map[int]bool, len(value))
+	return recursiveCheckMemo(value, funcs, memo)
+}
+
+func recursiveCheckMemo(value []string, funcs []func(string) bool, memo map[int]bool) bool {
+	if cached, ok := memo[len(value)]; ok {
+		return cached
+	}
+	result := false
+outer:
 	for i := 0; i < len(value); i++ {
 		tempVal := strings.Join(value[:i+1], " ")
 		for _, j := range funcs {
-			if j(tempVal) && (len(value[i+1:]) == 0 || recursiveCheck(value[i+1:], funcs)) {
-				return true
+			if j(tempVal) && (len(value[i+1:]) == 0 || recursiveCheckMemo(value[i+1:], funcs, memo)) {
+				result = true
+				break outer
 			}
 		}
 	}
-	return false
+	memo[len(value)] = result
+	return result
 }
 
 func in(value []string, arr []string) bool {
diff --git a/css/handlers_test.go b/css/handlers_test.go
new file mode 100644
index 0000000..70a78c8
--- /dev/null
+++ b/css/handlers_test.go
@@ -0,0 +1,121 @@
+// Copyright (c) 2019, David Kitchen <david@buro9.com>
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// * Redistributions of source code must retain the above copyright notice, this
+//   list of conditions and the following disclaimer.
+//
+// * Redistributions in binary form must reproduce the above copyright notice,
+//   this list of conditions and the following disclaimer in the documentation
+//   and/or other materials provided with the distribution.
+//
+// * Neither the name of the organisation (Microcosm) nor the names of its
+//   contributors may be used to endorse or promote products derived from
+//   this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package css
+
+import (
+	"strings"
+	"testing"
+	"time"
+)
+
+// TestIssue225 is a regression test for
+// https://github.com/microcosm-cc/bluemonday/issues/225.
+//
+// Shorthand property handlers such as FontHandler tokenize their value
+// and feed it to recursiveCheck, which searches for a way to partition
+// the tokens so that every group is accepted by one of a handful of
+// functions. A style value whose tokenization produces several
+// whitespace-only entries (as happens when a declaration is indented
+// with newlines and runs of spaces, like the payload in issue #225)
+// gives that search many equally valid split points, since a
+// whitespace-only entry is accepted as an "empty" font-family by
+// FontFamilyHandler. Before this fix, recursiveCheck re-explored the
+// same remaining tokens once per partition path that reached them,
+// making it exponential in the number of tokens: on the vulnerable
+// revision, 20 blank tokens took upwards of 15 seconds to evaluate
+// (measured via the full bluemonday.Policy.Sanitize pipeline).
+//
+// This test guards against that regressing: it must complete well
+// within the deadline below on a fixed/patched recursiveCheck, and it
+// times out (rather than hanging for the several seconds the
+// unmemoized search would take) if the exponential behaviour returns.
+//
+// Note that the pathological value below is ultimately rejected
+// (FontHandler returns false for it, confirmed against both the fixed
+// and the pre-fix code): the vulnerability is not about a value being
+// wrongly accepted, it is that recursiveCheck could take exponential
+// time to reach *either* verdict. Measured directly against FontHandler
+// on the vulnerable revision, this exact value took ~4s; the equivalent
+// value with 20 spaces of indentation took ~15s end-to-end through
+// bluemonday.Policy.Sanitize.
+func TestIssue225(t *testing.T) {
+	// 20 blank tokens, produced the same way the issue #225 payload
+	// produced them: a run of spaces immediately after a newline.
+	pathological := "normal\n" + strings.Repeat(" ", 20) + "16px\nroboto"
+
+	const deadline = 3 * time.Second
+	const want = false
+
+	result := make(chan bool, 1)
+	go func() {
+		result <- FontHandler(pathological)
+	}()
+
+	select {
+	case got := <-result:
+		if got != want {
+			t.Errorf("FontHandler(%q) = %v, want %v", pathological, got, want)
+		}
+	case <-time.After(deadline):
+		t.Fatalf("FontHandler did not return within %v for a 20-blank-token "+
+			"value; recursiveCheck may have regressed to exponential-time "+
+			"behaviour (see issue #225)", deadline)
+	}
+}
+
+// TestIssue225AcceptanceUnchanged asserts that the recursiveCheck
+// memoization added to fix issue #225 does not change which values are
+// accepted or rejected by a shorthand handler; it only changes how fast
+// that determination is made. Expected results were captured from
+// FontHandler's existing (pre-fix) behaviour.
+func TestIssue225AcceptanceUnchanged(t *testing.T) {
+	tests := []struct {
+		value string
+		want  bool
+	}{
+		// Representative valid "font" shorthand values (the first two
+		// mirror cases already exercised end-to-end in
+		// TestStyling in sanitize_test.go).
+		{"italic bold 12px/30px Georgia, serif", true},
+		{"icon", true},
+		{"caption", true},
+		{"normal 16px Roboto", true},
+		{"bold 16px/1.5 Arial, sans-serif", true},
+		// Representative invalid/unsafe values that must stay rejected.
+		{"expression(alert(1))", false},
+		{"javascript:alert(1)", false},
+		{"url(evil.com)", false},
+	}
+	for _, tt := range tests {
+		if got := FontHandler(tt.value); got != tt.want {
+			t.Errorf("FontHandler(%q) = %v, want %v", tt.value, got, tt.want)
+		}
+	}
+}