Police have confirmed they “secured” an unexploded bomb in a church in Surabaya.
It comes after three bombs went off at three other churches in the city, causing multiple deaths and leaving dozens wounded.
Authorities had earlier said they were investigating whether there was an explosion at a fourth church.
Police ordered the temporary closure of all churches in Surabaya, and a large food festival in the city was cancelled.
Forty people including two police officers were taken to hospital with injuries following the attacks.
The explosions targeted the Santa Maria Catholic Church, the Indonesian Christian Church and the Pentecost Central Church.
A police spokesman said the St. Maria explosion killed four people and two people were killed at each of the other two churches.
Media reports said at one church, a woman with a younger child and a teenager was being questioned by security when the bomb exploded.
Police have confirmed the explosions all occurred within 10 minutes of each other.
The first bombing happened at around 7.30am local time.
The spokesman said: “Right now there are only three locations.
“Do not believe in misleading information that the bomb exploded in five locations or any others.”
“We suspect it is a suicide bomb attempt.
“We have identified one victim.”
Footage seen by Express.co.uk show a number of dead bodies.
People at the scene desperately tried to help the injured.
Television images showed toppled motorcycles and debris scattered around the entrance of one church.
Police have not identified the attackers.
The bombings come just days after Islamist militant prisoners killed five members of an elite counter-terrorism force during a 36-hour standoff at a high-security jail on the outskirts of the capital, Jakarta.
In January 2016 four suicide bombers and gunmen attacked a shopping area in central Jakarta.
In the early 2000s, Indonesia was rocked by terrorist attacks by affiliates of al Qaeda, including a bomb attack in Bali that killed 202 people, many of them foreign tourists.