Gov. Vasip Sahin said the attacker, armed with a long-barreled weapon, killed a policeman and a civilian outside the club before entering and firing on people partying inside. He did not say who may have carried out what he called a "terror attack."
"Unfortunately (he) rained bullets in a very cruel and merciless way on innocent people who were there to celebrate New Year's and have fun," Sahin told reporters.
Some customers jumped into the waters of the Bosporus to escape the attack, the report said.
NTV television said the assailant may still be inside the nightclub.
More From This Section
Footage from the scene showed at least six ambulances with flashing lights and civilians being escorted out. NTV said police had cordoned off the area and an operation to capture the assailant was ongoing.
Security measures had been heightened in major Turkish cities, with police barring traffic leading up to key squares in Istanbul and the capital Ankara. In Istanbul, 17,000 police officers were put on duty, some camouflaged as Santa Claus and others as street vendors, state news agency Anadolu reported.
Ankara and Istanbul have been targeted by several attacks in 2016 carried out by the Islamic State group or Kurdish rebels, killing more than 180 people.