The 29-year-old surfer was attacked at remote Diamond Head, south of Port Macquarie, about 10.45am (AEDT) on Friday, Ambulances NSW said.
It is believed he was bitten by a bull shark.
Officials from the NSW Department of Primary Industries officials are on their way to the attack site to verify the size and species of the shark, a spokeswoman for Surf Life Saving told AAP.
The young man lost his right index finger and knuckle and has a bite wound to his right thigh.
He was airlifted to John Hunter Hospital in a serious but stable condition.
Adam Eady, from the Crowdy Head Surf Life Saving Club, south of the attack site, said beaches from Crowdy Head to Camden Haven to the north had closed as a precautionary measure.
The stretch of coastline where the young surfer was attacked was unpatrolled and shark sightings in the area were rare, he said.
"At this time of year, it really is unusual for sharks to be around this close in," he said.
A Surf Life Saving NSW spokeswoman said one of the surfer's mates had raised the alarm.
"I believe he was surfing with others, so one of his mates paddled in," she said.
Beaches in the region could remain closed for 24 hours, she said.
A co-owner of the Diamond Beach Holiday Park, Donna King, said she had lived in the area for 10 years and never heard of a similar incident.
"There's been sightings of sharks, but no attacks that we're aware of," she said.