My version of ash seems unaffected. Do you have more info?

    # env x='() { :;}; echo vulnerable' /bin/sh -c "echo this is a test"
    this is a test
    # env x='() { :;}; echo vulnerable' /bin/ash -c "echo this is a test"
    this is a test