He was airlifted to John Hunter Hospital in a serious but stable condition.
Adam Eady, from the Crowdy Head Surf Life Saving Club, south of the attack site, said beaches from Crowdy Head to Camden Haven to the north had closed as a precautionary measure.
The stretch of coastline where the young surfer was attacked was unpatrolled and shark sightings in the area were rare, he said.
"At this time of year, it really is unusual for sharks to be around this close in,'' he said.
A Surf Life Saving NSW spokeswoman said one of the surfer's mates had raised the alarm.
"I believe he was surfing with others, so one of his mates paddled in,'' she said.
Beaches in the region could remain closed for 24 hours, she said.
A co-owner of the Diamond Beach Holiday Park, Donna King, said she had lived in the area for 10 years and never heard of a similar incident.
"There's been sightings of sharks, but no attacks that we're aware of,'' she said.