The 29-year-old, named Luke, was attacked near remote Diamond Head, south of Port Macquarie, on Friday morning by what is believed to be a bull shark.
He was was bitten on the leg about 10.45am and then on the hand as he tried to push the shark away, Surf Life Saving said.
Paramedic Ian Spencer said the surfer had been bitten on his thigh and groin and had also “lost a couple of fingers on his left hand”.
Luke’s mates used the leg ropes on their surfboards as tourniquets to stem the bleeding, the Nine Network reported.
“They absolutely saved this guy’s life,” Mr Spencer told Nine.
Luke was still conscious when he was airlifted to Newcastle’s John Hunter Hospital in a serious but stable condition and his injuries are not life-threatening.
His family thanked those who helped him out of the water.
“The family express their gratitude to all those who assisted at the beach, as well as the emergency personnel who gave such rapid assistance,” they said in a statement.
Luke, from the NSW central coast, had been camping with family and friends, according to local Fairfax Media.
He was surfing when a pod of dolphins came through the waves, according to the Fairfax report, and he was attacked about 10 minutes later.
Adam Eady, from Crowdy Head Surf Life Saving Club, south of the attack site, said beaches from Crowdy Head north to Camden Haven had closed as a precaution and could remain closed for up to 24 hours.
The stretch of coastline where the surfer was attacked was unpatrolled and shark sightings in the area were rare, he said.
“At this time of year, it really is unusual for sharks to be around this close in,” he said.
Surf Life Saving’s state lifesaving manager, Dean Storey, said holiday-makers concerned about sharks should swim at patrolled beaches.
“That way lifesavers and lifeguards can clear the water in the event of a shark sighting and first aid support and equipment is immediately available,” Mr Storey said.
A co-owner of the Diamond Beach Holiday Park said she had lived in the area for 10 years and never heard of a similar incident.
“There’s been sightings of sharks but no attacks that we’re aware of,” Donna King told AAP.
Friday’s attack follows an incident on the mid-north coast three weeks ago in which a diver suffered minor puncture wounds after a suspected grey nurse shark attack at South West Rocks, about 110 kilometres north of Diamond Head.
Image via Getty