Upstash wouldn’t be vulnerable - Upstash doesn’t run upstream redis, it’s a protocol-compatible proprietary implementation.

I would guess it is.

Also:

Exploitation of this vulnerability requires an attacker to first gain authenticated access to your Redis instance.